Fix crash in NaClIPCAdapter where incomplete messages incorrectly

chrome/nacl/nacl_ipc_adapter.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/nacl/nacl_ipc_adapter.h"
 
 #include <limits.h>
 #include <string.h>
 
 #include "base/basictypes.h"
@@ skipping 250 matching lines @@
     nacl_abi_size_t desc_count = static_cast<nacl_abi_size_t>(descs_.size());
     CHECK(desc_count <= msg->ndesc_length);
     msg->ndesc_length = desc_count;
     for (nacl_abi_size_t i = 0; i < desc_count; i++) {
       // Copy the NaClDesc to the buffer and add a ref so it won't be freed
       // when we clear our ScopedVector.
       msg->ndescv[i] = descs_[i]->desc();
       NaClDescRef(descs_[i]->desc());
     }
     descs_.clear();
+  } else {
+    msg->ndesc_length = 0;
   }
   return static_cast<int>(bytes_to_write);
 }
 
 NaClIPCAdapter::LockedData::LockedData()
     : channel_closed_(false) {
 }
 
 NaClIPCAdapter::LockedData::~LockedData() {
 }
@@ skipping 387 matching lines @@
   header.payload_size = static_cast<uint32>(msg.payload_size());
   header.routing = msg.routing_id();
   header.type = msg.type();
   header.flags = msg.flags();
   header.num_fds = static_cast<int>(rewritten_msg->desc_count());
 
   rewritten_msg->SetData(header, msg.payload(), msg.payload_size());
   locked_data_.to_be_received_.push(rewritten_msg);
 }